statistic_fields = ['packet_size_mean', 'packet_size_variance',
                    'packet_len_total_count', 'packet_len_total_average', 'packet_len_total_min',
                    'packet_len_total_max',
                    'packet_len_total_rate', 'packet_len_0_19_count', 'packet_len_0_19_average', 'packet_len_0_19_min',
                    'packet_len_0_19_max', 'packet_len_0_19_percent', 'packet_len_40_79_count',
                    'packet_len_40_79_average',
                    'packet_len_40_79_min', 'packet_len_40_79_max', 'packet_len_40_79_rate', 'packet_len_40_79_percent',
                    'packet_len_80_159_count', 'packet_len_80_159_average', 'packet_len_80_159_min',
                    'packet_len_80_159_max',
                    'packet_len_80_159_rate', 'packet_len_80_159_percent', 'packet_len_160_319_count',
                    'packet_len_160_319_average',
                    'packet_len_160_319_min', 'packet_len_160_319_max', 'packet_len_160_319_rate',
                    'packet_len_160_319_percent',
                    'packet_len_320_639_count', 'packet_len_320_639_average', 'packet_len_320_639_min',
                    'packet_len_320_639_max',
                    'packet_len_320_639_rate', 'packet_len_320_639_percent', 'packet_len_640_1279_count',
                    'packet_len_640_1279_average', 'packet_len_640_1279_min', 'packet_len_640_1279_max',
                    'packet_len_640_1279_rate',
                    'packet_len_640_1279_percent', 'packet_len_1280_2559_count', 'packet_len_1280_2559_average',
                    'packet_len_1280_2559_min', 'packet_len_1280_2559_max', 'packet_len_1280_2559_rate',
                    'packet_len_1280_2559_percent', 'packet_len_more_than_5120_count',
                    'packet_len_more_than_5120_average',
                    'packet_len_more_than_5120_min', 'packet_len_more_than_5120_max',
                    'packet_len_more_than_5120_percent',
                    'all_req_packet_size_mean', 'all_req_packet_size_var', 'all_res_packet_size_mean',
                    'all_res_packet_size_var',
                    'all_req_packet_time_period_mean', 'all_res_packet_time_period_mean',
                    'all_req_packet_time_period_var',
                    'all_res_packet_time_period_var', 'req_header_count_mean', 'http.uri_length_mean',
                    'http.uri_length_var',
                    'http.uri_param_count_mean', 'http.uri_param_count_var', 'http.uri_depth_mean',
                    'http.uri_depth_var',
                    'http.uri_filename_length_mean', 'http.uri_filename_length_var']

origin = ['protocol', 'http.uri', 'http.response-content-type', 'http.serverVersion', 'http.xffIp',
          'http.clientVersion', 'http.statuscode', 'http.bodyMagic', 'http.request-content-type',
          'http.serverVersionCnt', 'http.useragent', 'http.request-referer', 'http.path', 'http.response-server',
          'http.method', 'http.key', 'http.hostTokens', 'http.requestHeader', 'http.responseHeader', 'dns.ASN',
          'dns.RIR', 'dns.GEO', 'dns.alpn', 'dns.ip', 'dns.host', 'dns.OpCode', 'dns.Puny', 'dns.QueryClass',
          'dns.QueryType', 'dns.status', 'tls.cipher', 'tls.dstSessionId', 'tls.ja3', 'tls.ja3s', 'tls.ja4',
          'tls.srcSessionId', 'tls.version', 'src_host', 'src_user_agent', 'src_connection', 'src_content_type',
          'src_x_forwarded_for', 'src_accept', 'src_accept_encoding', 'src_accept_language', 'src_referer',
          'src_cookie', 'src_origin', 'src_n', 'src_x_requested_with', 'src_sec_fetch_mode', 'src_sec_fetch_site',
          'src_sec_fetch_dest', 'src_content_encoding', 'src_sec_ch_ua', 'src_sec_ch_ua_mobile',
          'src_sec_ch_ua_platform', 'src_cache_control', 'src_pragma', 'src_x_real_ip', 'src_soapaction',
          'src_x_forwarded_proto', 'src_x_forwarded_host', 'src_x_request_id', 'src_x_forwarded_port',
          'src_x_forwarded_scheme', 'src_x_original_forwarded_for', 'src_authorization', 'src_trace_id',
          'src_distinct_id', 'src_url_path', 'src_if_modified_since', 'src_ecid_context', 'src_token',
          'src_access_control_request_method', 'src_access_token', 'src_access_control_request_headers',
          'src_sec_fetch_user', 'src_accept_charset', 'src_usercode', 'src_logincode', 'src_range', 'src_requestsource',
          'src_if_range', 'src_if_none_match', 'src_sw8', 'src_x_sign', 'src_x_timestamp', 'src_charset',
          'src_sec_websocket_key', 'src_sec_websocket_extensions', 'src_xms_auth_token', 'src_x_prototype_version',
          'src_systemcode', 'src_client_version', 'src_requestid', 'src_x_mule_encoding', 'src_x_mule_session',
          'src_x_mule_root_message_id', 'src_priority', 'src_server', 'src_transfer_encoding',
          'src_xxl_job_access_token', 'src_te', 'src_access_control_allow_origin', 'src_eset_spread_control',
          'src_x_splunk_digest', 'src_x_splunk_lm_nonce', 'src_x_splunk_lm_signature', 'src_set_cookie',
          'src_x_oracle_dms_ecid', 'src_client', 'src_post', 'src_ucosessionid', 'src_user', 'src_winuser',
          'src_digest', 'src_access_control_allow_methods', 'src_keep_alive', 'src_postman_token',
          'src_x_xss_protection', 'src_vary', 'src_access_control_allow_headers', 'src_signdata', 'src_yssip',
          'src_location', 'src_content_language', 'src_x_forwarded_prefix', 'src_x_ua_compatible', 'src_x_bd_traceid',
          'src_proxy_connection', 'src_via', 'src_area', 'src_check', 'src_clientname', 'src_networktype', 'src_nonce',
          'src_osversion', 'src_screen', 'src_userid', 'src_x_frame_options', 'src_kbn_version',
          'src_access_control_expose_headers', 'src_from', 'src_allow', 'src_etag', 'src_x_csrftoken', 'src_preip',
          'src_preivkapp', 'src_preivkhost', 'src_tlogspanid', 'src_x_playback_session_id', 'src_imgids',
          'src_am_traceid', 'src_xms_backend_server', 'src_sssessionid', 'src_client_requesttoken',
          'src_strict_transport_security', 'src_referrer_policy', 'src_x_amz_request_id', 'src_x_miorigin',
          'src_bussno', 'src_imgfilepath', 'src_imgid', 'src_x_powered_by', 'src_x_csrf_token', 'src_busscode',
          'src_prod_sw8', 'src_client_ip', 'src_content_transfer_encoding', 'src_remote_addr', 'src_traceid',
          'src_cf_ray', 'src_content_disposition', 'src_content_range', 'src_content_security_policy',
          'src_jenkins_crumb', 'src_p3p', 'src_tc_anp', 'src_tc_entsig', 'src_tc_spanid', 'src_tc_traceid',
          'src_www_authenticate', 'src_x_cache_status', 'src_x_clickhouse_query_id', 'dst_n', 'dst_content_type',
          'dst_transfer_encoding', 'dst_connection', 'dst_set_cookie', 'dst_x_oracle_dms_ecid', 'dst_content_language',
          'dst_cache_control', 'dst_server', 'dst_pragma', 'dst_access_control_allow_origin', 'dst_keep_alive',
          'dst_vary', 'dst_access_control_allow_methods', 'dst_access_control_allow_headers', 'dst_etag',
          'dst_content_encoding', 'dst_access_control_expose_headers', 'dst_x_xss_protection',
          'dst_access_control_request_headers', 'dst_x_frame_options', 'dst_location', 'dst_x_powered_by', 'dst_p3p',
          'dst_x_ua_compatible', 'dst_x_mule_encoding', 'dst_x_mule_session', 'dst_x_amz_request_id',
          'dst_content_disposition', 'dst_content_range', 'dst_allow', 'dst_xms_backend_server',
          'dst_x_clickhouse_query_id', 'dst_referrer_policy', 'dst_content_security_policy', 'dst_content_id',
          'dst_sec_websocket_accept', 'dst_sec_websocket_extensions', 'dst_via', 'dst_x_cache', 'dst_x_amz_cf_id',
          'dst_x_amz_cf_pop', 'dst_x_request_id', 'dst_www_authenticate', 'dst_strict_transport_security',
          'dst_x_splunk_digest', 'dst_x_splunk_lm_nonce', 'dst_content_transfer_encoding', 'dst_x_arequestid',
          'dst_x_ausername', 'dst_x_asessionid', 'dst_accept_charset', 'dst_kbn_license_sig', 'dst_kbn_name',
          'dst_audit_id', 'dst_cf_ray', 'dst_x_cache_status', 'dst_ctl_cache_status', 'dst_request_id',
          'dst_x_csrf_token', 'dst_hostname', 'dst_browseruid', 'dst_page_title', 'dst_x_ws_request_id', 'dst_gsid',
          'dst_link', 'dst_x_reqid', 'dst_login', 'dst_x_nws_log_uuid', 'dst_x_instance_identity', 'dst_x_jenkins',
          'dst_x_jenkins_session', 'segmentCnt', 'tcpflags.rst', 'tcpflags.ack', 'tcpflags.syn', 'tcpflags.psh',
          'tcpflags.syn-ack', 'tcpflags.fin', 'source.port', 'source.packets', 'source.bytes', 'destination.port',
          'destination.bytes', 'destination.packets', 'ipProtocol', 'protocolCnt', 'server.bytes', 'totDataBytes',
          'network.packets', 'network.bytes', 'client.bytes', 'http.bodyMagicCnt', 'http.clientVersionCnt',
          'http.response-content-typeCnt', 'http.xffIpCnt', 'http.requestHeaderCnt', 'http.responseHeaderCnt',
          'http.useragentCnt', 'http.methodCnt', 'http.uriCnt', 'http.keyCnt', 'http.hostCnt', 'http.pathCnt',
          'http.method-GET', 'http.method-POST', 'dns.alpnCnt', 'dns.ipCnt', 'dns.OpCodeCnt', 'dns.QueryClassCnt',
          'dns.QueryTypeCnt', 'dns.statusCnt', 'tls.cipherCnt', 'tls.ja3Cnt', 'tls.ja3sCnt', 'tls.ja4Cnt',
          'tls.versionCnt', 'tls.ja4_r', 'tls.ja4_rCnt', 'http.uri_length_mean', 'http.uri_length_var',
          'http.uri_param_count_mean', 'http.uri_param_count_var', 'http.uri_depth_mean', 'http.uri_depth_var',
          'http.uri_filename_length_mean', 'http.uri_filename_length_var', 'src_content_length',
          'src_upgrade_insecure_requests', 'src_checktime', 'src_x_splunk_lm_timestamp', 'src_expires',
          'src_nx_anti_csrf_token', 'src_st', 'src_timestamp', 'src_access_control_max_age', 'src_tlogtraceid',
          'src_vivo_browser_text_zoom', 'src_contents_client_adapter_id', 'src_client_requestts', 'src_bdpparallelload',
          'src_comcode', 'src_createuser', 'src_x_envoy_upstream_service_time', 'src_age', 'src_x_cid',
          'dst_content_length', 'dst_expires', 'dst_access_control_max_age', 'dst_tlogtraceid',
          'dst_rgwx_embedded_metadata_len', 'dst_rgwx_mtime', 'dst_rgwx_obj_pg_ver', 'dst_rgwx_object_size',
          'dst_x_envoy_upstream_service_time', 'dst_age', 'dst_x_splunk_lm_timestamp', 'dst_x_runtime', 'dst_x_w_no',
          'dst_x_cid', 'dst_sc', 'dst_x_response_timestrap', 'packet_size_mean', 'packet_size_variance',
          'packet_len_total_count', 'packet_len_total_average', 'packet_len_total_min', 'packet_len_total_max',
          'packet_len_total_rate', 'packet_len_0_19_count', 'packet_len_0_19_average', 'packet_len_0_19_min',
          'packet_len_0_19_max', 'packet_len_0_19_percent', 'packet_len_40_79_count', 'packet_len_40_79_average',
          'packet_len_40_79_min', 'packet_len_40_79_max', 'packet_len_40_79_rate', 'packet_len_40_79_percent',
          'packet_len_80_159_count', 'packet_len_80_159_average', 'packet_len_80_159_min', 'packet_len_80_159_max',
          'packet_len_80_159_rate', 'packet_len_80_159_percent', 'packet_len_160_319_count',
          'packet_len_160_319_average', 'packet_len_160_319_min', 'packet_len_160_319_max', 'packet_len_160_319_rate',
          'packet_len_160_319_percent', 'packet_len_320_639_count', 'packet_len_320_639_average',
          'packet_len_320_639_min', 'packet_len_320_639_max', 'packet_len_320_639_rate', 'packet_len_320_639_percent',
          'packet_len_640_1279_count', 'packet_len_640_1279_average', 'packet_len_640_1279_min',
          'packet_len_640_1279_max', 'packet_len_640_1279_rate', 'packet_len_640_1279_percent',
          'packet_len_1280_2559_count', 'packet_len_1280_2559_average', 'packet_len_1280_2559_min',
          'packet_len_1280_2559_max', 'packet_len_1280_2559_rate', 'packet_len_1280_2559_percent',
          'packet_len_more_than_5120_count', 'packet_len_more_than_5120_average', 'packet_len_more_than_5120_min',
          'packet_len_more_than_5120_max', 'packet_len_more_than_5120_percent', 'all_req_packet_size_mean',
          'all_req_packet_size_var', 'all_res_packet_size_mean', 'all_res_packet_size_var',
          'all_req_packet_time_period_mean', 'all_res_packet_time_period_mean', 'all_req_packet_time_period_var',
          'all_res_packet_time_period_var', 'req_header_count_mean']
